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(54) IN-CIRCUIT EMULATOR 

(57)Abstract: . 

PURPOSE: To execute sufficiently enough debugging even when a high 
speed MPU is a target by providing a built-in chip in a target device with a 
specific debugging unit. 

CONSTITUTION: The built-in chip 10 in the target device is provided with 
the debugging unit 20 having a state analyzing trace function, a non-brake 
debugging function for executing real-time on-chip debugging resource in all 
states without stopping the running of a target MPU and an on-chip monitor 
memory access interface function. Since the unit 20 for executing a part of 
the functions of an ICE is included in the chip 10 including the MPU in the 
target device, the necessity of a buffer or the like used for data transfer 
between a conventional target device and the ICE is eliminated, and thereby 
the speed of data to be processed can be increased. 
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* * NbTICES * 
JPO and NCIPI are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 

[Claim 1] The incircuit emulator characterized by preparing the debugging unit which has the nopbreak 
debugging function to perform the tracing facility for the State analysis, and a real time on-chip 
debugging resource by all the State, without stopping transit of Target MPU. and the monitor memory 
access interface function of an off chip, in the inclusion chip which is the incircuit emulator which 
debugs target equipment and is in target equipment. 

[Claim 2] It is the incircuit emulator according to claim 1 which possesses the external INTAFEt spin for 
connecting with the chip exterior at said debugging unit, and is characterized by this external INTAFEI 
spin enabling modification of the number of pins by the application of MPU and its application. 

[Translation done.] 
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DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Industrial Application] This invention relates to the incircuit emulator which enabled high-speed 

debugging in more detail about an incircuit emulator. 

[0002] 

[Description of the Prior Art] An incircuit emulator (it omits Following ICE) is in the equipment which 
accesses MPU in a target (testing device-ed), and debugs Target MPU. There are the following as a 
function of general ICE. 

[0003] ** When connecting ICE to the emulation functional target of the target memory and changing a 
part of memory in a target, it is vicarious execution ****** at the memory in ICE about the memory in a 
target. Usually, since the memory of a target is made of ROM. modification of a part of program etc. is 
difficult. Then, if the memory in a target is made to execute by proxy by the memory in ICE, since RAM 
can be used as memory in ICE, modification of a program etc. can be performed freely. Moreover, also 
when predetermined memory does. not exist in a target, a program is included in the memory in ICE and 
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the emulation of a target is made. 

[0004] ** It is the same as that of the function of the logic analyzer of the history tracing facility former, 
and is the function which records the data on two or more steps of buses of the front and back from a 
trigger time. The cause of a failure can be diagnosed by analyzing the data on the pass of order when a 
failure occurs to equipment. 

[0005] ** It is the function which suspends actuation of MPU of a target activation breaking functional 
target (breaking), and reads the contents of the various registers in MPU at the halt time etc. The cause 
of the failure of a target can be diagnosed. 
[0006] 

[Problem(s) to be Solved by the Invention] Each of three above-mentioned functions was judged by the 
ICE side based on the signal which MPU outputs, and each function is realized. However, if a bus cycle 
is set to 30MHz or more, the conditional judgment which performs each function by the ICE side will 
become difficult. 

[0007] When it states concretely, the time amount taken to judge whether it is the address which takes 
a break is 30-40nS from an address effective point in time. Therefore, if the setup of MPU and the hold 
time are taken into consideration, and bus cycle 30MHz is exceeded, it will become impossible to supply 
a breaking instruction from the ICE side, moreover, an ICE exchange when MPU is a single chip sake — 
separately — the chip for evaluation — it is necessary to manufacture — chip makers, such as cost, 
and a development schedule, and a user — it is a burden also for any. 

[0008] This invention is made in view of such a technical problem, and even when high-speed MPU is a 

target, it aims at offering the incircuit emulator which can perform sufficient debugging. 

[0009] 

[Means for Solving the Problem] This invention which solves the above mentioned technical problern is 
an incircuit emulator which debugs target equipment, and is characterized by to prepare the debugging 
unit which has the nonbreak debugging function to perform the tracing facility for the State analysis, and 
a real time on-chip debugging resource by all the State, without stopping transit of Target MPU, and the 
monitor memory access interface function of an off chip, in the inclusion chip in target equipment. 
[0010] In; this case, the external INTAFEI spin for connecting with the chip exterior at said debugging 
unit is provided, and it is desirable [ this external INTAFEI spin ] to enable modification of the number of 
pins by the application of MPU and its application, when it corresponds to the application of MPU and its 
application flexibly^ 
[0011]" 

[Function] In the inclusion chip (enibeded chip) containing MPU in target equipment, the debugging unit 
which performs a part of function of ICE was prepared. The buffer used by this when exchanging data 
between target equipment and ICE conventionally becomes unnecessary, and the data rate which can be 
treated part picking can be made quick. For example, what was able to be treated only to about ^ 
conventional bus cycle 30MHz can treat now to about 100MHz. 

[0012] In this case, the external INTAFEI spin for connecting with the chip exterior at said debugging 
unit is provided, and by enabling modification of the number of pins by the application of MPU and its 
application, this external INTAFEI spin can respond flexibly by the application of MPU and its application, 

and is convenient. - - - 

[0013] 

[Example] Hereafter, the example of this invention is explained to a detail with reference to a drawing. 
Drawing 1 is the configuration block Fig. showing one example of this invention. In drawing, the inclusion 
chip (it is also called an embeded chip) with which 10 is attached in target equipment, and 20 are 
debugging units (it is also called the IDB unit) with the debugging function prepared in this inclusion chip. 
Although this debugging unit 20 is attached in the form of a chip in the inclusion chip 10, it is a part. 
[0014] In the inclusion chip 10, 1 is a MPU core. In this MPU core 1, an NMI terminal is used for 
compulsive breaking (stop a MPU core) of an ICE function, and the breaking after activation. If this 
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terminal is asserted (activation), it will move from the following bus cycle to exception handling. An INT 
terminal is an interruption input terminal and is used as front [ activation ] breaking. When the 
instruction with which this terminal was asserted goes into the' activation queue of the pipeline of a 
MPU core, it shifts to exception handling, without executing this instruction. The instruction at the time 
of INT terminal assertion is assumed to be grinding or the thing which obtained to SWI (software 
interrupt). 

[0015] The cache memory by which 2 is connected with the MPU core 1,-and 2a are the breaking 
memory attached to cache memory 2. This breaking memory 2a is incorporated by the INT terminal of a 
MPU core together with the instruction of the address which the MPU core 1 fetches from cache 
memory 2. • / - c , . 

[0016] The external bus controller by which 3 is connected with -cache memory 2, the I/O device (I/O) 
by which 5 is connected with a bus 4, RAM by which 6 is connected with a bus 4, and 7 are flash ROMs 
(ROM in which read/write is possible) connected with a bus 4. This flash ROM 7 is ROM for supporting 
the mask ROM built in in target equipment. Access of this flash ROM has become possible by the 
program of the monitor memory under breaking (after^mentioned). 

[0017] 8 is breaking memory and has the size of 1 bit xn.;Here, n is given by the degree type. 
By the number-of-bits / minimum order bit length of n=ROM, for example, 256-bit ROM, when the 
minimum instruction of a MPU core is 8 bit length, it is set to n=256/8=32. Therefore, the capacity of 
the breaking memory 8 at this time becomes 32 bits. 

10018] Moreover, the breaking memory 8 is arranged on the same memory map as a flash ROM 7, and is 
loaded to breaking memory 2a of the INT terminal of the MPU core 1, or cache memory 2 synchronizing 
with the lead of the data of a flash ROM 7. A setup (make it 1 from 0) of the breaking memory 8 is set 
up during breaking by asserting the break point terminal 9 to breaking setting address access and 
coincidence by the monitor memory program. . 

[0019] Next, the configuration of the debugging unit 20 is explained. It connects with the address bus of 
the MPU core 1. a "data bus, and a status signal, and this: debugging unit 20 has the INTAFEI spin 1 1 with 
the chip exterior. ICE occupies this external INTAFEI spin:l 1. About the number.of this pin, .the optimal 
number can be set up now by the MPU core 1 or the applicatidh application; In addition, n can consider 
the case of 1, 3, 5, 7, 15, 31, and 63. Thus, by taking the configuration connected with ICE through, 
external INTAFEI spin, the optimal number can be set up by the MRU core 1 or the application 
application, and it is convenient. Here, the case of n= 15 of DBG (n:0) explains (bus widthiof face is : 
shown.). (n:0) It is below the same. .i ; ; 

[0020] It is the trace section which outputs the address bfthci instruction with which: 12 is performing 
undec target run, the serial monitor access section in which 13 performs access INTAFEISU of. the MPU 
Core l and monitor memory under breaking,, and the nonbreak debugging section^ by which\1 4 controls 
initialization of the:>ICE resource in a . chip, data modification of the specific target memory; and the > 
monitoring facility of the specific target memory, and it can carry out, without stopping a target run. from 
the-ICE side: And these trace section 12, the serial monitor access section.13; and the nonbreak; : \ 
debugging section 14 are connected with the MPU core 1. :15 is the INTAFEISU selector of the 
debugging unit 20, and selects the functional block 12-14 decided in the mode: A DBGMODE.(1:0) signal 

is inputted into this selector 15 as a select signal, . . ; . 

[0021] 21 is the selector connected with the debugging unit 20 through the external INTAFEI spin 11, 
and- selects the ICE resource decided in the mode. A DBGMODE (1:0) signal is inputted into, this . ; ; 
selector 21 as a select signal. As a signal exchanged between a selector 15 and a selector 21, there are 
DBG (n:0), DBGCLK (clock signal), DBGS, and DBGMODE (1:0). . . i 

[0022] The debugging unit 20 can recognize now any of three functions of trace, serial monitor access, 
and nonbreak debugging are connected with. the external. INTAFEI spin 1.1 by mode signal DBGMODE 
(1:0). Moreover, also in the chip exterior, a selector 21 connects the signal pin of;the external INTAFEI 
spin 11 to one block of the trace memory 22 which corresponds to the present mode with a DBGMODE 
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*(1:0) signal, the monitor memory 23, and the nonbreak debugging controller 24. And the signal of the 
trace section 12 goes into the trace memory 22, the output of the monitor memory 23 goes into the 
MPU core 1 through the serial monitor access section 13, and the output of the nonbreak debugging . 
controller 24 goes into the MPU core 1 through the nonbreak debugging section 14. Thus, it will be as 
follows if actuation of the constituted circuit is explained. 

[0023] This invention has the description in the point of having carried the debugging unit 20 which 
performs a part of ICE function in the inclusion chip 10 in a users target equipment. This debugging unit 
20 shall possess the ICE function of extent which does not become a user s burden. In the conventional 
ICE, the configuration which incorporates from an ICE body and accesses a chip was taken. Therefore, 
components, such as the buffer gate, needed to be used between them and the rate of a clock of 
operation was restrained by about several 10MHz by the stray capacity which exists between the delay 
during I/O of a component, and a wire length. So, in this invention, it is that of the peach which enabled 
it to extend the clock of operation which makes the buffer gate etc. unnecessary, consequently can be 
used to about 100MHz by carrying the function of ICE in a user s inclusion chip 10. Hereafter, the 
moving function of the circuit of drawing 1 is explained. 

[0024] As for the external INTAFEI spin 1 1 of drawing 1 i each function is selected by the contents of 
DBGMODE (1:0) of Table 1. That is, it is in transformer State mode at monitor access mode and the 
time of DBGM0DE=11 at NBD (nonbreak debugging) mode and the time of DBGMODE=10 at trace PC 
mode and the time of DBGMODE=01 at the time of DBGMODE=00: In addition, target mode, monitor 
access mode, and transformer State mode are trace PC modes, and NBD mode is monitor mode. Either 
of NBD mode is accessible. 
[0025] 
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[0026] Transition of a DBGMODE (1:0) signal is explained. 

DBGMODE (0): Chip input signal. It is used for the demand of NBD(nonbreak debugging) MODE to the 
MPU core 1. 1 shows under a demand and NBD actuation. 

DBGMODE (1): Chip output signal. It is shown that 1 is under breaking (serial monitor access mode). It is 
shown that 0 is [ target ] under run. At this time, the MPU core 1 is during target memory access. The 
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debugging unit 20 is PC trace or NBD mode. 

[0027] Table 2 shows the definition of DBGMODE (1:0), a debugging unit (IDB) function, and the external 

INTAFEI spin 11. 

[0028] 

[Table 2] 
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[0029] (1) During a target run (DBGMODE=00X a PC tracing facility PC tracing facility carries out time 
sharing of the address of the instruction under activation of the MPU core 1 from the trace section 12. 
and outputs it to the external INTAFEI spin 11 through a selector 15. In the chip exterior, a selector 21 
connects with the trace memory 22, and the signal of the external INTAFEI spin 1 1 is sampled by the 
trace memory 22 under control of a PCH clock and PCHSEQ. 

[0030] The contents of an output of PC trace are outputted by time sharing from an address high order. 
The example of an output is explained below. 

** In the case of the number of signal lines of address width-o^-face <=DBG (n:0) of the MPU core 1, 
output all the addresses to coincidence synchronizing with the bus cycle of MPU. 
[0031] ** In the case of the number of signal lines of address width-of-face >DBG (n:0) of the MPU 
core 1. by branching of a program etc.. when the address of the MPU core 1 is not sequential, output an 
upper address, and when sequential, output a lower address. Drawing 2 and drawing 3 are drawings 
showing the output timing in trace PC mode. The case where the address width of face of drawing 3 of 
the MPU core 1 is 16 bits and DBG (7:0) about the case where the address width of face of drawing 2 of 
the MPU core 1 is 32 bits and DBG (15:0) is shown, respectively. 

[0032] the address with which, as for N-SEQ, the MPU core 1 outputs the contents from which the 
contents to which PCH (15:0) is outputted by IDB in the output address of the MPU core 1 are written 
to A (31:0) in SUB (31:0) by the trace memory 22 in drawing 2 — non — the case where the address 
with which, as for SEQ. MPU outputs the case of being sequential (when there being program branching 
etc.) is sequential is shown, respectively. nOPC shows the signal with, which the MPU core 1 leads a 
program on "0" level, respectively, the address with which, as for N-SEQ. the MPU core 1 outputs the 
contents from which the contents to which PCH (7:0) is outputted from the debugging unit 20 in the 
output address of the MPU core 1 are written to A (15:0) in SUB (15:0) by the trace memory 22 in 
drawing 3 — non. the case where the address with which, as for SEQ. the MPU core 1 outputs the case 
of being sequential is sequential is shown, respectively. In the case of drawing 3 , all the addresses are 
memorized by memory. 

[0033] ** When it cannot be defined as the number which needs the number of signal lines of DBG (n:0) 
to perform address output of the MPU core 1. output only the address which program branching of the 
MPU core 1 generated in this case. When the following branch address occurs during a branch-address 
output, it enables it to identify in the chip exterior by negating a PCHSEQ signal (deactivation) and 
performing a new branch-address output. Drawing 4 and drawing 5 are drawings showing the timing in 
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the trace PC mode at this time of operation. The case where the address width of face of drawing 5 of 
the MPU core 1 is 16 bits and DBG (3:0) about the case where the address width of face of drawing 4 of 
the MPU core 1 is 16 bits and DBG (3:0) is shown, respectively, the case of drawing 4 — the case of 
drawing 3 — differing — branching — the address — non, only a branch address is memorized by 
memory when it becomes sequential. 

[0034] (3) While Target MPU takes a break, a serial monitor access functional serial monitor access 
function is used in order to access the program of the monitor memory of an off^chip through signal 
lines, such as DBG (n:0), (when it is DBGMODE(1:0) =10). Access is outputted and inputted by time 
sharing in order of the State, the address, and data. The address and data are transmitted from a high 
order bit. The contents of the State are a lead, a light, a program fetch, and a valid byte. In the case of a 
32-bit data bus (D31-D0), a valid byte tells the chip exterior about an effective cutting tool (D7-D0) at 
the time of cutting tool access. 

[0035] Since SDI (n-1/2:0) of the bus for serial monitor accesses and the bit width efface of SDO (n- 
1/2:0) are decided, it is necessary to carry out time sharing of the State, the address, and the data, and 
to transmit them by the number of DBG (n:0), A setup of the division number is set up by the function 
of nonbreak debugging. 

[0036] Drawing 6 is drawing showing the timing of the light cycle in serial monitor access of operation. 
Drawing shows the case of DBG (15:0). There is one bus cycle of MPU core 1 self to SDCLK1- 
SDCLK13. A data light is carried out to the monitor memory 23 in falling of BUSCLK2. 
[0037] A serial monitor bus carries out time sharing of the address already outputted from the MPU 
core 1, data, and the State by BUSCLK1, and outputs them to the monitor memory 23 among drawing in 
the path of the serial monitor access section 13 -> selector 15 -> selector 21 -> monitor memory 23. 
Two ****sXn:0) of DBG(s) are used as the bus SDO (n-1/2:0) for an output, and the bus SDI for an 
input (n-1/2:0) through the selector 21 at the time of monitor memory access. The light data to the 
monitor memory 23, the State, and the address are divided into the bus width efface of SDO (n-1/2:0), 
and are outputted from SDO (n-1/2:0) of a selector 21. 

[0038] In drawing 6 , when light data are SDCLK12, in the chip exterior, a light (writing) is carried out to 
the monitor memory 23 by falling of SDCLK13, i.e., falling of BUSCLK, by that of all bit ****. 
[0039] Drawing 7 is drawing showing the timing of the read cycle in serial monitor access of operation. 
Drawing shows the case of DBG (15:0). In a read cycle, the output of the State and the address is . 
performed like a light. ICE recognizes it as a read cycle in the chip exterior by the lead in the State, and 
transfer of a light bit. The monitor memory 23 side sets up the data applicable to the address outputted 
by SDGLK6 to SDCLK7. The serial monitor access section 13 incorporates D31-D0 of the chip exterior 
by time sharing through SDI (n-1/2:0) from SDCLK8. And if it gathers all bits (D31-D0) inside a chip in 
SDCLK12, the MPU core 1 leads D31-D0 in falling of SDCLK13, i.e., falling of BUSCLK2. 
[0040] (3) Nonbreak debugging (NBD) 

Nonbreak debugging (NBD) is INTAFEISU which can access an on-chip debugging resource from the 
chip outside by all the State, without taking a break the MPU core 1 under target run in the path of the 
nonbreak debugging section 14 -> selector 15 -> selector 21 -> nonbreak debugging controller 24. The 
resource of NBD on chip has the memory which became independent of the memory map of the MPU 

core 1. There are four functions shown below in NBD. 

[0041] ** initialization function: — setting ** RAM monitoring facility [ of on-chip debugging reset ]: — 
lead-out ** dynamic tuning function [ of the newest access data of the specific address ]: — data 
modification ** reserve [ of the specific address ]: — future MPU and drawing 8 for an escape (access 
flow of NBD) of application are drawings showing the memory map of NBD. Initial setting is performed to 
the initialization field of a NBD map, a RAM monitor is set as a RAM monitor area, and a dynamic tuner 
is set as a dynamic tuning field. Thus, the access flow of the block diagram of drawing 9 and drawing 10 
explains access of the NBD resource of the constituted meniory map. In drawing 9 , 10 incorporates and, 
as for a chip (refer to drawing 1 ) and 1, a MPU core and 14 are the nonbreak debugging sections. 30 is 
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a NBD control block and consists of SHIRI / a Para transducer 31. a register group 32. and a decoder 
33-. The register group 32 consists of PO register, P1 register, and P2 register. 40 is an ICE control unit 
and contains CPU41 of ICE inside. 

[0042] In drawing 8 . data "AAH" (H shows a hexadecimal) are performed to the EOO street latch 
address A (31:24) as follows, when carrying out a light 

** Carry out the light of the "8EH" which means the light to a RAM monitoring facility to PO register. 
[0043] ** Carry out the light of "OOH" of changing into P1 register about the address A in a RAM 
monitor memory map (31:24). 

** In order to change the contents of the address A in a RAM monitor memory map (31:24) into P2 
register at "AAH", carry out the light of the "AAH." 

[0044] In a lead, a light is carried out and the contents of A (31:24) in a RAM monitor memory map can 
lead "OEH" by leading P2 register at PO register, 

[0045] According to this invention, the following effectiveness is acquired. 

** Also in an inclusion chip (single chip) without external access INTAFEISU, since history. trace for 
debugging was enabled, debugging of the program execution of a MPU core, a trace, etc. can be 
performed. 

[0046] ** The debugging resource in a chip can be accessed, without taking a break target run actuation 
of a MPU core by having prepared the nonbreak debugging function. Thereby, the function of debugging 
can be used now for real time, without affecting a MPU core. 

[0047] ** Since monitor serial access INTAFEISU was prepared, it can control by the pace by the side 
of ICE during breaking. Moreover, also in a single chip without an external bus, activation of a monitor 
program is attained by this function. 

[0048] ** Since on-chip breaking memory was prepared, it can take a break certainly also in the time of 
a high speed MPU or a single chip. 

** Since IDB is made to a disable at the time of ICE intact even if it defines the function of the above- 
mentioned ** - ** on a real chip, it can be used as an initial flow term of target MPU on chip as it is. 
Moreover, since it is not necessary to manufacture EBACHIPPU, a port emulator, etc. for evaluation 
separately even when there is no external access INTAFEISU at a single chip etc., a merit comes out of 
cost and a development schedule for a user and a chip maker. 
[0049] 

[Effect of the Invention] As mentioned above, as explained to the detail, according to this invention, the 
debugging unit which performs a part of function of ICE was prepared in the inclusion chip (embeded 
chip) containing MPU in target equipment. The buffer used by this when exchanging data between target 
equipment and ICE conventionally becomes unnecessary, and the data rate which can be treated part 
picking can be made quick. For example, what was able to be treated only to about conventional bus 
cycle 30MHz can treat now to about 100MHz. 

[0050] In this case, the external INTAFEI spin for connecting with the chip exterior at said debugging 
unit is provided, and by enabling modification of the number of pins by the application of MPU and its 
application, this external INTAFEI spin can respond flexibly by the application of MPU and its application, 
and is convenient. 

[0051] Thus, according to this invention, even when high-speed MPU is a target, the-incircuit emulator 
which can perform sufficient debugging can be offered. 
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* NOTICES * 
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damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing 1] It is the configuration block Fig, showing one example of this invention. 
[Drawing 2] It is drawing showing the output timing in trace PC mode. 
[Drawing 3] It is drawing showing the output timing in trace PC mode. 
[Drawing 4] It is drawing showing the output timing in trace PC mode. 
[Drawing 5] It is drawing showing the output timing in trace PC mode. 

[Drawing 6] It is drawing showing the timing of the light cycle in serial monitor access of operation. 
[Drawing 7] It is drawing showing the timing of the read cycle in serial monitor access of operation. 
[Drawing 8] It is drawing showing the memory map of NBD. 
[Drawing 9] It is the explanation block diagram of a NBD access flow. 
[Drawing 10] It is drawing showing a NBD access flow. 
[Description of Notations] 
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11 External INTAFEI Spin 

12 Trace Section 

13 Serial Monitor Access Section 

14 Nonbreak Debugging Section 

15 Selector 

21 Selector 

22 Trace Memory 

23 Monitor Memory 

24 Nonbreak Debugging Controller 
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